CVE-2024-8900: Mozilla Firefox Auth Bypass Vulnerability

CVE-2024-8900 Overview

CVE-2024-8900 is a clipboard manipulation vulnerability in Mozilla Firefox, Firefox ESR, and Thunderbird. An attacker can write arbitrary data to a user's clipboard without triggering the standard user prompt during a specific sequence of navigational events. The flaw affects Firefox versions before 129, Firefox ESR before 128.3, and Thunderbird before 128.3. Mozilla addressed the issue in security advisory MFSA-2024-33. The vulnerability is classified under [CWE-732] (Incorrect Permission Assignment for Critical Resource) and carries an EPSS score of 0.426%.

Critical Impact
Attackers can silently overwrite clipboard contents during web navigation, enabling clipboard hijacking attacks that substitute cryptocurrency addresses, commands, or sensitive text without user awareness.

Affected Products

Mozilla Firefox versions earlier than 129
Mozilla Firefox ESR versions earlier than 128.3
Mozilla Thunderbird versions earlier than 128.3

Discovery Timeline

2024-09-17 - CVE-2024-8900 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8900

Vulnerability Analysis

The vulnerability resides in how Firefox enforces user consent for clipboard write operations. Browsers normally require a user gesture or display a prompt before allowing pages to overwrite the system clipboard via the Async Clipboard API. During a specific sequence of navigational events, this consent gate is bypassed, allowing JavaScript on a malicious page to call clipboard write methods without triggering the permission UI.

The issue maps to [CWE-732] because clipboard write permission, a critical resource control, is incorrectly granted under certain state transitions. Refer to the Mozilla Security Advisory MFSA-2024-33 and the Mozilla Bug Report for upstream technical detail.

Root Cause

The root cause is improper permission state tracking across navigations. When the browser transitions between documents in a particular order, the internal flag governing clipboard write authorization is not correctly reset or revalidated. This permits a page to inherit or assume clipboard write authority it should not possess.

Attack Vector

Exploitation requires the victim to visit an attacker-controlled web page. The attacker crafts a sequence of navigations (such as redirects, iframe loads, or history manipulations) that triggers the prompt bypass. Once the bypass is active, JavaScript on the page calls navigator.clipboard.writeText() or related APIs to silently replace the clipboard contents. No user interaction beyond browsing is required.

This is commonly abused in pastejacking attacks, where attackers substitute copied cryptocurrency wallet addresses, shell commands, or URLs with malicious equivalents that users then paste into wallets, terminals, or address bars.

Detection Methods for CVE-2024-8900

Indicators of Compromise

Unexpected clipboard content changes following web browsing sessions, particularly involving cryptocurrency addresses or command strings.
Browser telemetry showing Firefox versions below 129 or ESR/Thunderbird below 128.3 in the enterprise fleet.
Web traffic to pages that perform rapid client-side navigations or redirects followed by clipboard API calls.

Detection Strategies

Inventory Firefox, Firefox ESR, and Thunderbird installations and flag any instance below the patched version baseline.
Monitor endpoint software inventory feeds for outdated Mozilla browser builds.
Review proxy and DNS logs for connections to known pastejacking or clipboard-abuse domains.

Monitoring Recommendations

Track browser version compliance through configuration management and EDR software inventory.
Alert when end users report unexpected paste content, especially in finance, DevOps, and administrative workflows.
Correlate browser version data with vulnerability scanner output to surface unpatched hosts.

How to Mitigate CVE-2024-8900

Immediate Actions Required

Update Firefox to version 129 or later on all managed endpoints.
Update Firefox ESR to version 128.3 or later.
Update Thunderbird to version 128.3 or later.
Enable automatic browser updates through enterprise policy where feasible.

Patch Information

Mozilla released fixes in Firefox 129, Firefox ESR 128.3, and Thunderbird 128.3. Patch details are published in Mozilla Security Advisory MFSA-2024-33, with related fixes documented in MFSA-2024-47 and MFSA-2024-49.

Workarounds

Educate users to verify clipboard contents before pasting cryptocurrency addresses or commands into sensitive targets.
Restrict use of unpatched Firefox or Thunderbird versions through application allow-listing until updates are deployed.
Deploy enterprise policy templates to force browser updates on launch.

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Force Firefox update via policies.json (place in distribution policies directory)
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true
  }
}